CVE-2026-72666 Elastic CVE debrief

Who should care

Elastic Kibana administrators, security teams, and users with access to Osquery live queries should be aware of this vulnerability and take defensive actions. Affected operators include those managing Kibana spaces, Osquery configurations, and Elastic Agent deployments. Vulnerability management and security teams should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified. Platform impact includes potential data disclosure from Elastic Agents in different Kibana spaces, and security teams should monitor for suspicious query activity against Elastic Agents and verify Kibana and Elastic Agent configurations for proper ACLs and access controls.

Technical summary

A medium-severity vulnerability (CVE-2026-72666) in Kibana allows an authorized user to execute queries against Elastic Agents in a different space, potentially disclosing information from those hosts. This occurs because Kibana does not properly constrain access control lists (ACLs) for Osquery live queries across different Kibana spaces. An attacker with access to Osquery live queries in one space can execute queries on hosts belonging to another space, leading to unauthorized data disclosure.

Defensive priority

Medium-priority defensive actions are recommended due to the potential for unauthorized query execution against Elastic Agents.

Recommended defensive actions

• Review and apply vendor-provided security updates for Kibana
• Restrict access to Kibana spaces and Osquery live queries
• Monitor for suspicious query activity against Elastic Agents
• Verify Kibana and Elastic Agent configurations for proper ACLs and access controls
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

Evidence from the NVD and Elastic sources indicates a medium-severity vulnerability in Kibana, allowing for unauthorized query execution. However, detailed information about affected versions and remediation steps is limited. Defenders should verify Kibana and Elastic Agent configurations for proper ACLs and access controls, review Osquery live query activity, and monitor for suspicious query patterns against Elastic Agents.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.